CVE-2026-107300

Published: Oct 8, 2026Modified: Oct 8, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

Related CWEs

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (3)

https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba

Source: security-advisories@github.com

https://github.com/mcollina/msgpack5/releases/tag/v6.1.0

Source: security-advisories@github.com

https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9

Source: security-advisories@github.com

Timeline

No history available yet.